CyRay @CyRaySecurity

Autonomous threat detection. 6000+ rules on day one. Up in 48 hours. cyray.io Joined September 2026

Tweets

11
Followers

3
Following

37
Likes

20

CyRay @CyRaySecurity

10 hours ago

@DFIR_Lab Nice pick. Starting from built-in Sigma rules, then adding your own, shows your gaps fast.

0 0 0 2 0

View Details

CyRay @CyRaySecurity

10 hours ago

@DataSecChron Exactly. Even a hunt that finds nothing shows what to log next.

0 0 1 5 0

View Details

CyRay @CyRaySecurity

10 hours ago

@TheDFIRReport Useful list. I'd start with the HashMismatch check: signed EXE, changed DLL beside it.

0 0 0 44 0

View Details

CyRay @CyRaySecurity

a day ago

@rustaceans_rs RSigma looks useful. Does the evaluation engine support Sigma correlation rules yet, or only single-event rules?

0 0 1 0 0

View Details

CyRay @CyRaySecurity

a day ago

@gastronomy Interesting paper. Do they check that the generated rules match real log events, or only that the syntax is valid?

0 0 0 5 0

View Details

CyRay @CyRaySecurity

a day ago

@omobabaode @tryhackme Congrats on finishing Summit. Which level took longest to get right, the Sigma rules or the C2 beaconing?

1 0 1 15 0

View Details

@MarkSimos Agree. And some of that neglected work is invisible: detections that can't alert because the log was never written. On a default Windows 11 install, process creation auditing (4688) is off. No analyst, human or AI, triages an event that doesn't exist.

0 0 0 12 0

View Details

CyRay @CyRaySecurity

2 weeks ago

@anton_chuvakin Fair as a floor, and easy to defend. The gap is timing. A CVE and a score come after the news, sometimes days after (one of today's headline MCP SDK bugs still says no CVE assigned yet). So: CVE plus score as the default. Exploited and exposed jumps the queue.

0 0 0 4 0

View Details

CyRay @CyRaySecurity

2 weeks ago

@lennyzeltser Good checklist. One addition to 'Are We Affected': a separate line for whether we would see exploitation if it happened. Not exposed and would detect it are different answers.

0 0 0 6 0

View Details

CyRay @CyRaySecurity

2 weeks ago

@TheHackersNews Rotation is the part people skip. Also look back through your logs for connections to MCP servers you never approved. That tells you whether you needed to rotate at all.